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REMARKS 

In the Final Office Action dated June 29, 2004, the Examiner allowed claims 3, 4, 
and 14 and rejected claims 1, 2, and 7-13. By this Amendment, Applicants have 
amended claims 1, 7, 10, and 12, and added new claim 15, taking care not to add any 
new matter. 

Information Disclosure Statements 

Applicants have not received initialed 1449 forms for the Information Disclosure 
Statements filed on October 3, 2002, September 1 7, 2003, or January 6, 2004. For the 
Examiner's convenience, Applicants enclose herewith additional copies of the 1449 
forms filed with those Statements. Applicants request that the Examiner initial and 
return the 1449 forms to indicate that he has considered the listed references. 

Section 102 Rejections 

In the Office Action, the Examiner rejected claims 1,2, 12, and 13 under 35 
U.S.C. § 102(e) as anticipated bv Touboul . U.S. Patent No. 6,092,194 (" Touboul '194 "). 
The Examiner also rejected claims 3, 4, 7-11, and 14 under 35 U.S.C. § 102(e) as 
anticipated bv Touboul , U.S. Patent No. 6,154,844 (" Touboul '844 "). 

To anticipate a claim under 35 U.S.C. § 102, the reference must teach every 
element of the claim. M.P.E.P. § 2131.01 (8 th ed. 2001, revised February 2003). 
Applicants continue to contend that the Examiner has not shown that Touboul '194 
teaches every element of claims 1 , 2, 12, and 13. For example, the Examiner has not 
shown a teaching in the reference of using downloaded code to invoke a method on the 
server, wherein the downloaded code enforces a set of constraints on the server, as 
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recited in claims 2 and 13. Instead, the Examiner merely alleged that it is inherent that 
a downloadable disclosed in the reference invokes a method on a server because 
method invocation is well known in object oriented programming. (Final Office Action, 
p. 4.) 

Furthermore, the Examiner interpreted the claimed set of constraints as reading 
on the security policies of the reference. Even if this is correct, the security policies of 
Touboul '194 are used to determine whether to allow or block a Downloadable, (jd.) 
They are not enforced by the downloaded code. Because the Examiner has not shown 
that Touboul '194 teaches every element of claims 2 and 13, Applicants request the 
withdrawal of the section 102 rejections of these claims. 

Claim 1, as amended, recites a method including the step of determining a set of 
constraints specified by the client for conducting secure communication with a server 
via downloaded code. Touboul '194 does not teach such a method. The Examiner 
stated that the reference teaches a signed certificate appended to a downloadable 
security profile that indicates if the downloadable is to be trusted and likened this 
certificate to the claimed set of constraints. (Final Office Action, p. 2.) However, neither 
the signed certificate nor the security profile is specified by the recipient of the 
downloadable. Instead, the system of Touboul '194 discloses a security policy that 
compares data about the downloadable to a list of known hostile downloadables, 
access control lists, trusted certificates, or trusted URLs. (Id., col. 2, II. 11-20.) If the 
Downloadable passes these tests, then it is sent to its intended recipient. (Id., col. 6, II. 
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62-65.) The security policy of the reference is unrelated to a set of constraints specified 
by the client for conducting secure communication with a server. 

Amended claim 1 also recites the step of using secure code verified locally by the 
client to determine whether the downloaded code will enforce the set of constraints. 
Touboul '194 also fails to teach this element. Instead, the security system of the 
reference compares a Downloadable ID to a security policy to determine whether to 
send the Downloadable to its intended recipient. Comparing an identifier of the 
Downloadable to a security policy to determine whether to send the Downloadable to its 
intended recipient is unrelated to using secure code verified locally by the client to 
determine whether the downloaded code will enforce the set of constraints. 
Furthermore, even if the security policy of the reference can be interpreted as the 
claimed set of constraints, the security policy is enforced by the security system of the 
reference, not by downloaded code. ( Touboul '194 , col. 4, II. 45-47.) 

Because Touboul '194 fails to teach every element of amended claim 1 , the 
section 102 rejection of claim 1 should be withdrawn. 

Claim 12 recites a computer-readable medium containing instructions for 
controlling a data processing system to perform the method described in claim 1 . 
Therefore, for at least the reasons given above with respect to claim 1 , Applicants 
request the reconsideration and withdrawal of the section 102 rejection of claim 12. 

The Examiner relied on Touboul '844 to reject claims 7-1 1 under 35 U.S.C. 
§ 102(e). However, the reference fails to disclose every element of the claims as 
amended. For example, claim 7 recites a client program that specifies a set of 
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constraints for conducting secure communication with the service and a secure verifier 
that determines whether the proxy will enforce the set of constraints when 
communicating with the service. 

Touboul '844 discloses a system for attaching a security profile to a 
downloadable to protect computers from hostile downloadables. ( Touboul '844 , col. 1 , 
II. 23-27.) In particular, the reference discloses a content inspection engine that 
generates a downloadable security profile and links it to the corresponding 
downloadable. (IdL , col. 2, II. 3-9.) A protection engine compares the downloadable 
security profile to a signed certificate to determine whether to trust the profile. Qd^ col. 
2, II. 20-29.) The Examiner likens the security profile of the reference to the claimed set 
of constraints. However, the security profile of the reference is "a list of all potentially 
hostile or suspicious computer operations that may be attempted by the Downloadable, 
and may also include the respective arguments of those operations." ( Touboul '844 , 
col. 4, II. 4-7.) Thus, the security profile of the reference is unrelated to a set of 
constraints for conducting secure communication with the service. Furthermore, 
comparing a security profile to a signed certificate is unrelated to verifying that a proxy 
will enforce security constraints when communicating with a service. Because the 
Touboul '844 fails to teach every element of amended claim 7, Applicants request the 
reconsideration and withdrawal of the section 102 rejections of claim 7 and its 
dependent claims 8-11. 
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In view of the foregoing amendments and remarks, Applicants respectfully 
request reconsideration and continued examination of this application and the timely 
allowance of the pending claims. 

Please grant any extensions of time required to enter this response and charge 
any additional required fees to our deposit account 06-0916. 

Respectfully submitted, 



FINNEGAN, HENDERSON, FARABOW, 
GARRETT & DUNNER, L.L.P. 



Dated: August 31, 2004 
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